German Grid Sabotage Spreads West as Manhunt Widens Across Europe

A deliberate short circuit at an Amprion high-voltage substation in the Rheidt district of Bergheim, west of Cologne, forced five lignite-fired generating units off the German grid on the evening of Tuesday 1 September 2026. Police in Essen were called to the site at around 20:00 CEST after several lines failed. What was first logged as a technical fault was reclassified within hours as a criminal act, and North Rhine-Westphalia interior minister Herbert Reul told reporters the following morning that investigators were treating the case as sabotage directed against the constitutional order.

The method was crude but effective. Officers recovered six launch devices from a cornfield next to the installation. According to Cologne chief detective Michael Esser, the equipment was built to use pyrotechnic charges to throw a wire high over the overhead conductors. The wire tangled with the line and bridged the phases, producing the short circuit and the bright flashes seen along the corridor. Investigators are now working through mobile phone data and DNA traces recovered from the recovered hardware.

The generation impact was immediate. RWE Power confirmed that five lignite blocks at two sites in the Rhenish mining district dropped off the network: Neurath F and G at Grevenbroich, and Niederaussem G, H and K at Bergheim. Their combined nameplate capacity is roughly 4,200 megawatts, and about 3,000 megawatts were actually flowing into the system at the moment of the fault. That is one of the largest single-event losses of dispatchable capacity Germany has recorded outside a storm.

No customer lost supply. Amprion, the transmission system operator that owns the substation, drew replacement flows from other parts of its control area and kept the balance intact. Restoration was staged rather than immediate, because individual blocks have to cool, be inspected and then be cleared block by block before the connection points accept feed-in again. Neurath G and Niederaussem H returned during the morning of Wednesday 2 September, Neurath F followed the same evening, and RWE Power expects Niederaussem G and K back on the network over this weekend.

The Bergheim attack came less than twelve hours after a separate strike in the east. Shortly after 08:00 CEST on the same Tuesday, police found several improvised explosive and incendiary devices at the Preilack substation near Turnow-Preilack, the node that carries output from the Jaenschwalde lignite plant into the 50Hertz transmission network. At least one device detonated and damaged cables. Brandenburg police later opened a proceeding on suspicion of forming a terrorist organisation, alongside charges covering explosion offences and destruction of essential equipment. Brandenburg interior minister Jan Redmann described the pattern as a hybrid threat and said foreign involvement could not be excluded.

The situation escalated again this week. On the evening of Thursday 3 September a passer-by spotted a suspicious object at an electricity substation in Dormagen, between Cologne and Duesseldorf. Police in Neuss said the item could be an explosive device and that specialists were assessing whether it was capable of damaging the installation, while Cologne police stated that someone had apparently tried to trigger a short circuit deliberately. Investigators are now checking substations across the surrounding districts for similar objects. Early on Friday 4 September, officers in Ganderkesee near Bremen found the door of a control cabinet at a transformer station standing open at around 03:00 CEST and searched the area with a helicopter and dogs. Nothing was damaged and nobody was found. A further large police operation was launched around the Weisweiler plant and substation near Aachen after that location was named in written material sent to authorities.

Police confirmed receiving a letter claiming responsibility that referenced both the North Rhine-Westphalia and Brandenburg cases. German news agency dpa reported on Friday that two letters attributed to a 48-year-old man from Gevelsberg, near Dortmund, claim the attacks and cite opposition to electricity generation from fossil fuels as the motive. A Europe-wide search is under way. Officers raided the family home in Gevelsberg without finding him. Police have publicly cautioned that it still has to be established whether the author is the perpetrator or a copycat, although the letters reportedly contained details that had not been made public when they were written. One of the letters is also reported to threaten a further attack on an energy facility.

That single-actor environmental theory now sits alongside the two lines of inquiry authorities opened earlier in the week. Reul had said officials were examining both state-directed sabotage and left-wing extremism, and he stressed that investigating is not the same as knowing. The political backdrop makes the question sensitive. On Tuesday 1 September the federal government formally attributed an attempted hybrid attack to Russia, involving an explosive-laden drone at Leipzig/Halle Airport on 4 August, and announced diplomatic countermeasures. Germany also has recent precedent for domestic attacks on grid assets, after arson against high-voltage cables in southwest Berlin in January 2026 left tens of thousands of households and several hospitals without power for days. A spokesperson for Chancellor Friedrich Merz argued this week that the high proportion of failed or foiled attempts demonstrated that protective measures are working.

For supply chain managers the relevant signal is not the megawatt figure but the exposure it revealed. Three of the four sites approached in five days sit in the Rhenish mining district and the Cologne-Duesseldorf corridor, which is the densest concentration of chemical, aluminium, glass and automotive capacity in Germany. The attacks did not target the plants themselves. They targeted the connection points that move power from generation into the transmission network, which are lightly fenced, spread across open farmland and impossible to guard comprehensively. A wire thrown over a line by a firework costs almost nothing and can remove three gigawatts of firm output in seconds.

German industry has so far absorbed the shock without production losses, because reserve margins were comfortable in early September and demand is below winter peaks. The margin narrows sharply from November onwards. Amprion and the other transmission operators are expected to accelerate physical security work at exposed nodes, and the KRITIS resilience law obliging critical infrastructure operators to inventory and protect their assets gives them a legal framework to spend against. Utilities across the Netherlands, Belgium and France are reviewing perimeter arrangements at comparable substations, since the Rhenish corridor is directly coupled to their networks.

The investigation remains open and no arrest has been made. Authorities have not confirmed whether the four incidents share a single author, and the possibility of imitators acting on the publicity has been raised by police themselves. The Mecklenburg-Vorpommern state election on 20 September adds a further layer of political pressure on federal and state authorities to demonstrate results quickly.